MDR Harmonised Standards: What Is and Is Not on the List

Open almost any medical device technical file and you will find a sentence like “developed in accordance with the harmonised standard IEC 62304”. It is a claim anyone can check in about a minute, and under the EU MDR it is wrong.

IEC 62304 is not on the list of MDR harmonised standards. Neither is IEC 62366-1. Neither is EN ISO 20417. All three are state of the art, all three are expected by notified bodies, and none of them confers a presumption of conformity under Regulation (EU) 2017/745.

This is not a technicality about wording. It changes what your file has to demonstrate.

What a harmonised standard actually gives you

Article 8 of the EU MDR is precise: devices in conformity with the relevant harmonised standards, or the relevant parts of those standards, the references of which have been published in the Official Journal of the European Union, shall be presumed to be in conformity with the requirements of the Regulation covered by those standards or parts.

Three limits sit inside that sentence, and all three are missed routinely.

A standard is not made harmonised by being an EN, by appearing in a notified body’s checklist, or by a supplier’s datasheet saying so. It is made harmonised by an entry in the Official Journal, under a specific Implementing Decision, with a date of legal effect and sometimes an end of legal effect.

The three standards everyone gets wrong

Checked against the European Commission’s own summary list for Regulation (EU) 2017/745, generated 17 June 2026:

Sixty-five references are harmonised under the MDR. These three are not among them.

To be clear about what this does not mean: it does not mean stop applying them. IEC 62304 is the recognised way to run a medical device software lifecycle, IEC 62366-1 is how usability engineering is done, and notified bodies expect both. Applying them is the correct engineering decision.

What it means is that the conformity argument has to be made directly. Annex I §17 on electronic programmable systems and §5 on use error do not become satisfied by naming a standard that carries no presumption — they are satisfied by evidence.

What to write instead

The fix is a form of words, and it is short. Rather than:

Developed in accordance with the harmonised standard IEC 62304.

write something closer to:

The software lifecycle processes were established and applied in accordance with IEC 62304:2006+A1:2015. That standard is not currently cited in the Official Journal in support of Regulation (EU) 2017/745 and no presumption of conformity is claimed from it. Conformity with Annex I §§17.1 to 17.4 is demonstrated directly by [evidence references].

That version is accurate, it shows the manufacturer knows the difference, and it removes an easy finding. The first version invites a reviewer to check — and once one claim in a file turns out to be wrong, the rest get read differently.

Which ones are harmonised

The two that matter most to the documentation architecture both are:

That is why EN ISO 13485:2016 is the practical route to the quality management system Article 10(9) requires, and EN ISO 14971:2019 the practical route to the risk management system Annex I §3 requires.

A word on EN ISO 14971 while we are here, because it is the other thing routinely misstated: A11:2021 is a CEN amendment to the European adoption, not an ISO amendment. It adds the European foreword and Annex ZA — the clause mapping that confers the presumption. The technical requirements are identical to the international standard.

The list moves, roughly twice a year

Harmonised standards under the MDR are governed by Commission Implementing Decision (EU) 2021/1182, which has been amended ten times: 4 January 2022, 11 May 2022, 4 July 2023, 6 March 2024, 8 October 2024, 8 April 2025, 17 October 2025, 28 January 2026, 1 April 2026 and 11 June 2026.

Standards are added, re-cited under a later decision, and given an end of legal effect. EN ISO 15223-1:2021 currently appears twice — under a 2022 citation with an end of legal effect of 15 June 2031, and re-cited with effect from 17 June 2026. Several parts of the EN ISO 10993 series carry end dates of 15 December 2027.

This is why an undated conformity claim cannot be verified. A file that says “conforms to the harmonised standards” without naming editions, decisions and dates is asserting something no reader can confirm.

What happens when a citation is withdrawn

Withdrawal does not make a device non-conforming. It ends the presumption from the stated date, which means conformity with the affected requirements has to be shown another way — normally by adopting the new edition.

Article 10(9) makes this a continuous obligation, not a filing update. It requires procedures to keep series production in conformity, taking account of changes in the harmonised standards or common specifications by reference to which conformity is declared.

A sequence that works:

1. Identify every device and every GSPR row relying on the affected citation.
2. Obtain the new edition and perform a technical gap analysis against the applied version.
3. Decide: adopt the new edition, demonstrate conformity directly, or justify continued reliance with evidence.
4. Plan and complete any re-testing, and update the risk management file where the gap touches it.
5. Revise the affected GSPR checklist rows and the standards register.
6. Assess whether this is a change requiring notified body notification or approval.
7. Consider whether the declaration of conformity must be reissued.
8. Record the decision and its date.

Step 6 is the one that gets skipped and costs most. A change of applied standard can be a change to the approved device under Annex IX §4.10, which requires approval before implementation, not notification afterwards.

Common specifications are a different instrument

Where no harmonised standard exists or is sufficient, Article 9 lets the Commission adopt common specifications. Devices conforming to them are presumed to conform to the requirements they cover.

Article 9(3) normally lets a manufacturer depart from a common specification by duly justifying solutions that ensure a level of safety and performance at least equivalent.

Article 9(4) removes that option for Annex XVI products. Manufacturers of products without an intended medical purpose — contact lenses, cosmetic implants, dermal fillers, liposuction equipment, high-intensity light devices, transcranial stimulation equipment — shall comply with the relevant common specifications. There is no equivalence argument available. Those specifications are laid down in Commission Implementing Regulation (EU) 2022/2346.

Keeping a register that answers the right question

Most standards registers list what an organisation applies. The useful column is a different one: does a presumption of conformity attach, and when was that last verified?

A row worth having records the designation and edition, whether the reference is published in the Official Journal, the Implementing Decision and its date of legal effect, any end of legal effect, which parts were applied, any deviations, which GSPRs the presumption is relied on for — and the date the citation was last checked. That last field is what turns “we believe this is harmonised” into “we checked, on this date, against this decision”.

Check it on a schedule rather than incidentally: the list is amended about twice a year, and the standards bodies publish new editions before the citations move, which is the planning window for re-testing.

Our EU MDR Toolkit includes a harmonised standards and common specifications procedure and a standards register built around citation status and verification dates, plus a software, usability and AI interface guide that states the position on IEC 62304 and IEC 62366-1 accurately and supplies the wording for a technical file — alongside 64 further templates covering Regulation (EU) 2017/745 as consolidated on 19 July 2026.

Frequently asked questions

Is IEC 62304 harmonised under the EU MDR?

No. IEC 62304 does not appear on the Commission’s list of harmonised standards for Regulation (EU) 2017/745, verified against the summary list generated 17 June 2026. It remains the recognised state of the art for medical device software lifecycle processes and notified bodies expect it, but no presumption of conformity arises from applying it.

Is IEC 62366-1 harmonised under the EU MDR?

No, and neither is EN ISO 20417. Usability engineering evidence supports Annex I §5 on use error directly rather than by presumption.

What does a presumption of conformity actually do?

Under Article 8, it means a device conforming to a cited harmonised standard is presumed to conform to the MDR requirements that standard covers. Without it, the manufacturer must demonstrate conformity with those requirements by other evidence.

How often does the MDR harmonised standards list change?

Roughly twice a year. Commission Implementing Decision (EU) 2021/1182 has been amended ten times between January 2022 and June 2026.

Is EN ISO 14971:2019/A11:2021 an ISO amendment?

No. It is a CEN amendment to the European adoption, adding the European foreword and Annex ZA. The technical requirements are unchanged from ISO 14971:2019.

Can I depart from a common specification?

Under Article 9(3), yes, if you can duly justify solutions ensuring a level of safety and performance at least equivalent. Under Article 9(4), no — for products listed in Annex XVI, compliance with the relevant common specifications is mandatory.